@promptctl/cc-candybar 1.42.1 → 1.43.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@promptctl/cc-candybar",
-  "version": "1.42.1",
+  "version": "1.43.0",
   "description": "Statusline renderer for Claude Code — a JSON5-configurable DSL with daemon-cached data sources, byte-clean palette-aware composition, and OSC8 click verbs.",
   "type": "module",
   "main": "./dist/index.mjs",
@@ -57,7 +57,6 @@
     "dist",
     "bin",
     "plugin",
-    "src",
     "schema",
     "README.md",
     "LICENSE"
@@ -91,9 +90,9 @@
     "mobx": "^6.15.0"
   },
   "optionalDependencies": {
-    "@promptctl/cc-candybar-darwin-arm64": "1.42.1",
-    "@promptctl/cc-candybar-darwin-x64": "1.42.1",
-    "@promptctl/cc-candybar-linux-x64": "1.42.1",
-    "@promptctl/cc-candybar-linux-arm64": "1.42.1"
+    "@promptctl/cc-candybar-darwin-arm64": "1.43.0",
+    "@promptctl/cc-candybar-darwin-x64": "1.43.0",
+    "@promptctl/cc-candybar-linux-x64": "1.43.0",
+    "@promptctl/cc-candybar-linux-arm64": "1.43.0"
   }
 }

package/src/check.ts

@@ -1,478 +0,0 @@
-// [LAW:verifiable-goals] `cc-candybar check [path]` — the authoring agent's eyes.
-// Config diagnostics otherwise surface VISUALLY (composeWithDiagnostics renders
-// error/warning icons into the bar), a channel a blind config author never sees.
-// This command runs the production pipeline and projects its verdict onto a
-// text + exit-code contract a script can close its own loop on:
-//   0 — config loads and renders (warnings, if any, on stderr)
-//   1 — config is invalid (parse / validate / register / render failure)
-//   2 — usage error or a named file could not be read
-//
-// [LAW:single-enforcer] No parallel validation path: the verdict is reached
-// through the exact functions the daemon runs (RenderCache.reloadInto →
-// buildState, then the per-request render in server.ts) — resolveDslConfigPath →
-// detectConfigCollisions → loadConfig → validateConfig → registerDslConfig →
-// deriveActionValidators → renderDsl. "check passes" and "the daemon renders"
-// cannot diverge, because they are one code path.
-
-import fs from "node:fs";
-import path from "node:path";
-import process from "node:process";
-import {
-  loadConfig,
-  validateConfig,
-  resolveDslConfigPath,
-  detectConfigCollisions,
-  ConfigError,
-} from "./config/dsl-loader.js";
-import { expandHome } from "./config/loader/discovery.js";
-import { DEFAULT_DSL_CONFIG } from "./config/default-dsl-config.js";
-import { VariableStore } from "./var-system/store.js";
-import { SourceRegistry } from "./var-system/sources.js";
-import { SessionState } from "./daemon/session-state.js";
-import { registerDslConfig, renderDsl } from "./dsl/render.js";
-import { deriveActionValidators } from "./daemon/verbs/state-validators.js";
-import { lookKeyByName } from "./themes/policy.js";
-import { paletteForThemeName } from "./themes/palette-resolvers.js";
-import {
-  resolveEffectiveGlobals,
-  type EffectiveGlobals,
-} from "./daemon/render-payload.js";
-
-// [LAW:no-ambient-temporal-coupling] A fixed width keeps the verdict a function
-// of the config alone, not of whichever terminal invoked the check. Templates
-// evaluate in full before any width-driven wrap/pagination, so width shapes
-// layout, never diagnostics.
-const CHECK_WIDTH = 200;
-
-// One faked Claude Code hook event, shaped like the daemon's augmented payload
-// (see src/daemon/render-payload.ts) — the `input` vars read out of it by their
-// dotted `path`. [LAW:verifiable-goals] It is deliberately RICH (dirty git with
-// every worktree count, an upstream, a stash, a recent commit; home set; live
-// session/today/context/metrics/rate-limit data) so gated segments actually
-// RENDER their content instead of gating off. A minimal payload would let a
-// field-name typo in the git/directory/metrics/budget branches slip through —
-// those branches only run when their data is present.
-//
-// `effective` is threaded in exactly as the daemon threads it (server.ts
-// resolves one EffectiveGlobals struct per render and feeds BOTH the
-// payload's `*.effective` fields and BuildLineOptions/basePalette below)
-// [LAW:one-source-of-truth].
-//
-// test/example-configs.test.ts asserts rendered content against these literal
-// values (780s → "◷ 13m", cost $0.39, version 1.15.0, …); changing one here
-// fails that suite loudly rather than drifting silently.
-export function checkPayload(
-  effective: EffectiveGlobals,
-): Record<string, unknown> {
-  const home = "/home/tester";
-  const nowSec = Math.floor(Date.now() / 1000);
-  return {
-    hook_event_name: "Status",
-    session_id: "test0a1b-2c3d-4e5f-6a7b-8c9d0e1f2a3b",
-    version: "1.15.0",
-    home,
-    cwd: `${home}/code/cc-candybar/src`,
-    transcript_path: `${home}/.claude/projects/x/test.jsonl`,
-    model: { id: "claude-opus-4-8", display_name: "Opus 4.8" },
-    workspace: {
-      current_dir: `${home}/code/cc-candybar/src`,
-      project_dir: `${home}/code/cc-candybar`,
-    },
-    git: {
-      repoName: "cc-candybar",
-      repoUrl: "https://github.com/promptctl/cc-candybar",
-      branch: "main",
-      sha: "abc1234",
-      ahead: 2,
-      behind: 1,
-      staged: 3,
-      unstaged: 2,
-      untracked: 1,
-      conflicts: 0,
-      upstream: "origin/main",
-      stash: 1,
-      status: "dirty",
-      operation: "rebase",
-      timeSinceCommit: 780,
-    },
-    session: { cost: 0.39, tokens: 241400 },
-    today: { cost: 12.5, tokens: 3_400_000 },
-    context: { totalTokens: 48487, contextLeft: 24 },
-    metrics: {
-      lastResponseTime: 8.2,
-      responseTime: 4.2,
-      sessionDuration: 930,
-      messageCount: 8,
-      linesAdded: 512,
-      linesRemoved: 88,
-    },
-    block: { nativeUtilization: 63, resetsAt: nowSec + 2 * 3600 },
-    weekly: { percentage: 21, resetsAt: nowSec + 5 * 86400 },
-    cache: { expiresAt: nowSec + 15 * 60 },
-    tmux: { session: "work" },
-    // `ssh: true` for the same reason `tmux.session` is populated: this
-    // fixture deliberately satisfies every gate so a when-gated segment
-    // RENDERS and its template gets checked. A local-looking fixture would
-    // gate the host segment off and let a typo inside it ship.
-    host: { name: "tester-box", user: "tester", ssh: true },
-    theme: { effective: effective.theme },
-    look: { effective: effective.look },
-    // [LAW:one-source-of-truth] Was missing here even though EffectiveGlobals
-    // already carried `preset` — a pre-existing gap this ticket's own fixture
-    // needs closed: a preset trigger's `.preset.effective` label and
-    // brandon-layout-edit-2gc.5's `.preset.customized` gate both silently
-    // fell back to their declared defaults ("" / false) rather than the
-    // resolved value, exactly the drift the sibling `*.effective` fields
-    // already guard against.
-    preset: {
-      effective: effective.preset,
-      customized: effective.presetCustomized,
-    },
-    style: { effective: effective.style },
-    charset: { effective: effective.charset },
-    colorCompatibility: { effective: effective.colorCompatibility },
-    autoWrap: { effective: effective.autoWrap },
-    padding: { effective: effective.padding },
-  };
-}
-
-// [LAW:dataflow-not-control-flow] The check result is DATA — a pure function of
-// the target file's contents — discriminated into the three outcomes the exit-
-// code contract projects. `checkConfig` carries the decision; `runCheck` only
-// maps it to (streams, exit), so the contract is testable without spawning a
-// process or stubbing process.exit.
-//
-// `configPath` null means the bundled default was checked (no config file
-// found — the daemon renders the same default in that state).
-export type CheckOutcome =
-  | {
-      readonly kind: "clean";
-      readonly configPath: string | null;
-      readonly warnings: readonly string[];
-      readonly rendered: string;
-    }
-  | {
-      readonly kind: "fatal";
-      readonly configPath: string | null;
-      readonly message: string;
-      readonly warnings: readonly string[];
-    }
-  | {
-      readonly kind: "unreadable";
-      readonly path: string;
-      readonly message: string;
-    };
-
-// Run the daemon's load-and-render pipeline against one config target.
-//
-// With no target, the path resolves exactly as the daemon resolves it
-// (resolveDslConfigPath: $CC_CANDYBAR_CONFIG → project/cwd → XDG), so the file
-// this checks IS the file the daemon would load from this directory.
-//
-// [LAW:no-silent-failure] With an explicit target, the named file must exist
-// and be readable — a missing file is `unreadable`, never a fall-through to the
-// bundled default. (The daemon's --config-to-missing-file behavior — render the
-// default, watch for the file to appear — is liveness for a long-running
-// renderer; a verdict command must not report "clean" about a file it never
-// read.)
-export function checkConfig(
-  target: string | undefined,
-  cwd: string = process.cwd(),
-): CheckOutcome {
-  // [LAW:one-source-of-truth] No pre-read: the ONE content read of the config
-  // file is the readFileSync inside loadConfig. Readability is established by
-  // the same read that parses (no double I/O); the catch below classifies its
-  // errno failure as `unreadable`. The explicit-target statSync is a metadata
-  // probe at the argv trust boundary, not a second read: a directory target
-  // (`check .`) fails read() with a path-less EISDIR the catch could not
-  // attribute, so the not-a-file usage error is decided here.
-  const configPath =
-    target !== undefined
-      ? path.resolve(expandHome(target))
-      : resolveDslConfigPath(cwd, cwd);
-  if (target !== undefined && configPath !== null) {
-    // throwIfNoEntry suppresses only ENOENT (left for the content read to
-    // classify); EACCES/EPERM on the probe itself is equally "could not read
-    // the named file" — same outcome, not an uncaught stack.
-    let st: fs.Stats | undefined;
-    try {
-      st = fs.statSync(configPath, { throwIfNoEntry: false });
-    } catch (e) {
-      return {
-        kind: "unreadable",
-        path: configPath,
-        message: e instanceof Error ? e.message : String(e),
-      };
-    }
-    if (st !== undefined && !st.isFile()) {
-      return {
-        kind: "unreadable",
-        path: configPath,
-        message: "not a file",
-      };
-    }
-  }
-
-  // [LAW:dataflow-not-control-flow] Collision detection runs independent of
-  // load success — mirror of RenderCache.reloadInto: even if the .json5 fails
-  // to parse, the author still wants to know a shadowed .json sibling exists.
-  const warnings: string[] = [];
-  const collision = detectConfigCollisions(cwd, cwd);
-  if (collision !== null) warnings.push(collision);
-
-  try {
-    const rendered = loadRegisterRender(configPath, cwd, warnings);
-    return { kind: "clean", configPath, warnings, rendered };
-  } catch (e) {
-    // A filesystem error on the config file itself (ENOENT/EACCES from
-    // loadConfig's read — errno errors carry the failing `.path`, which is the
-    // discriminator against deeper fs failures) is the `unreadable` outcome:
-    // the named file could not be read at all, distinct from a file that read
-    // but is invalid. [LAW:no-silent-failure] — never a fall-through to the
-    // bundled default. Duck-typed, not `instanceof Error`: fs errors can cross
-    // a realm boundary (jest/graceful-fs), where instanceof lies.
-    const errno = e as Partial<NodeJS.ErrnoException> | null;
-    if (
-      configPath !== null &&
-      typeof errno === "object" &&
-      errno !== null &&
-      typeof errno.code === "string" &&
-      errno.path === configPath &&
-      typeof errno.message === "string"
-    ) {
-      return { kind: "unreadable", path: configPath, message: errno.message };
-    }
-    // Same classification RenderCache.reloadInto applies: ConfigError and
-    // register/render throws (template parse, MissingFieldError, action arity)
-    // are all author-facing diagnostics — the daemon would surface each via
-    // composeWithDiagnostics, so check surfaces each as fatal text.
-    const message =
-      e instanceof ConfigError
-        ? e.message
-        : e instanceof Error
-          ? e.message
-          : String(e);
-    return { kind: "fatal", configPath, message, warnings };
-  }
-}
-
-// The buildState + per-request-render mirror: every call below is the function
-// the daemon calls, in the daemon's order [LAW:single-enforcer]. Returns the
-// rendered line; appends the register pass's advisory `loadWarnings` (partial
-// declaration failures) to `warnings` — the same channel RenderCache merges
-// them into.
-function loadRegisterRender(
-  configPath: string | null,
-  cwd: string,
-  warnings: string[],
-): string {
-  const { config: merged, source } = loadConfig(configPath, DEFAULT_DSL_CONFIG);
-  const config = validateConfig(merged, configPath ?? "<default>", source);
-
-  const store = new VariableStore();
-  const registry = new SourceRegistry(
-    store,
-    config.globals.default_empty_value ?? "",
-    undefined,
-    new SessionState(),
-  );
-  try {
-    const compiled = registerDslConfig(config, registry, { cwd });
-    // Registered before the validator pass so a derive throw (a key-kind
-    // clash) still carries the partial-load warnings into the fatal outcome.
-    warnings.push(...compiled.loadWarnings);
-    // Derivation only (the throw-on-clash coherence pass over the action
-    // table); the daemon additionally registers the results in its global
-    // validator registry, which a one-shot check has no wire to serve.
-    deriveActionValidators(config);
-
-    // Fresh session (no clicked theme/style/look), so the session half of
-    // each resolution is null — the config default over the floor, exactly
-    // what the daemon renders for a session that has never clicked.
-    // [LAW:one-source-of-truth] The preset resolves first and its fragment's
-    // globals feed every field below, the SAME order the daemon resolves in
-    // (server.ts) — so `check` renders the arrangement a fresh session actually
-    // opens in, not the config's un-presetted root.
-    const effective: EffectiveGlobals = resolveEffectiveGlobals(
-      config,
-      // A fresh session: no clicked theme/style/look, and edit mode off. The
-      // resolution is THE daemon's (resolveEffectiveGlobals), not a copy that
-      // agrees with it today — which is the whole reason check renders what the
-      // daemon would render rather than something adjacent.
-      () => null,
-      // [LAW:no-silent-failure] `check` validates a config file in isolation
-      // — it never reads the daemon-owned overrides file, so there is no
-      // rootOps log to be customized BY. false is the honest value for THIS
-      // (primary, returned) render, not a stand-in default: a fresh session
-      // has never customized anything. A second render pass below also
-      // exercises `true`, so a `.preset.customized`-gated segment still
-      // gets checked — just not through this value.
-      () => false,
-    );
-    // [LAW:no-silent-failure] A segment whose template THROWS while evaluating
-    // (an `{{ action }}` display-arity mismatch, a MissingFieldError from a
-    // partially-declared variable) renders as a visible ⚠ error cell — partial
-    // rendering, the daemon's channel for a human looking at the bar. The blind
-    // authoring agent is not looking at the bar; check collects the same errors
-    // through the render's observer seam and fails the verdict, so exit 0 never
-    // blesses a bar that renders ⚠.
-    const renderOnce = (
-      payloadEffective: EffectiveGlobals,
-    ): { rendered: string; segmentErrors: Map<string, string> } => {
-      // [LAW:types-are-the-program] Keyed by segment NAME, not appended to a
-      // list — a segment errors at most once per pass, so this is the
-      // strongest true shape (dedupe-by-construction within one pass) and
-      // what makes deduping ACROSS the two passes below a plain key check
-      // rather than a message-text comparison.
-      const segmentErrors = new Map<string, string>();
-      const rendered = renderDsl(
-        config,
-        compiled,
-        store,
-        registry,
-        checkPayload(payloadEffective),
-        paletteForThemeName(payloadEffective.theme),
-        {
-          style: payloadEffective.style,
-          separator: payloadEffective.separator,
-          width: CHECK_WIDTH,
-          colorCompatibility: payloadEffective.colorCompatibility,
-          wrap: payloadEffective.autoWrap,
-          padding: payloadEffective.padding,
-          charset: payloadEffective.charset,
-        },
-        {
-          onSegmentError: (segName, message) =>
-            segmentErrors.set(segName, message),
-        },
-        {
-          look: lookKeyByName(config.looks, payloadEffective.look),
-          preset: payloadEffective.preset,
-        },
-      );
-      return { rendered, segmentErrors };
-    };
-
-    const primary = renderOnce(effective);
-    // [LAW:verifiable-goals] `.preset.customized` is the ONE gate this
-    // config surface adds that a rich, data-driven fixture (checkPayload's
-    // own stated design one comment up) can never drive true on its own —
-    // every OTHER field a segment might gate on is a VALUE checkPayload can
-    // just supply richly; this one is a daemon-resolved FACT about session
-    // state, not a hookData field a config author's own file ever carries.
-    // Without a second pass, a typo or MissingFieldError inside a user's
-    // OWN `when: '{{ .preset.customized }}'`-gated content (docs/
-    // interaction-authoring.md's own documented pattern) would pass check
-    // clean and only surface later as a live ⚠ error cell. Second pass
-    // only — the RETURNED rendering stays the realistic default (a fresh
-    // session has never customized anything); this pass exists purely to
-    // catch broken content behind the one gate the first pass can't reach.
-    const customizedCheck = renderOnce({
-      ...effective,
-      presetCustomized: true,
-    });
-
-    // [LAW:no-silent-failure] An UNCONDITIONAL segment error (one whose
-    // `when`, if any, is true in both passes — the two renders share the
-    // same config/store/registry and differ only in `presetCustomized`)
-    // fires in BOTH passes identically. Deduped by segment NAME rather than
-    // concatenated: a customizedCheck error is only genuinely NEW
-    // information when primary didn't already report that same segment —
-    // reporting it twice would double-count one bug and the "(under
-    // .preset.customized = true)" tag would misdirect the reader into
-    // thinking it's specific to that gate when it isn't.
-    const errors = [
-      ...[...primary.segmentErrors].map(
-        ([segName, message]) => `segment "${segName}": ${message}`,
-      ),
-      ...[...customizedCheck.segmentErrors]
-        .filter(([segName]) => !primary.segmentErrors.has(segName))
-        .map(
-          ([segName, message]) =>
-            `segment "${segName}": ${message} (under .preset.customized = true)`,
-        ),
-    ];
-    if (errors.length > 0) {
-      throw new Error(
-        `config renders with ${errors.length} segment error${
-          errors.length === 1 ? "" : "s"
-        } (the daemon would render ⚠ error cells):\n` +
-          errors.map((m) => `  ${m}`).join("\n"),
-      );
-    }
-    return primary.rendered;
-  } finally {
-    // [LAW:single-enforcer] The registry owns every async handle the config
-    // declared (timers, fs watchers, git subscriptions); a one-shot check must
-    // not leak them past the verdict.
-    registry.dispose();
-  }
-}
-
-const EXIT_CLEAN = 0;
-const EXIT_FATAL = 1;
-const EXIT_USAGE = 2;
-
-// [LAW:dataflow-not-control-flow] The outcome → (streams, exit-code) mapping is
-// DATA: a total fold over CheckOutcome returning one descriptor; runCheck runs
-// the two unconditional writes + exit against it. Verdict on stdout, every
-// diagnostic (warnings included) on stderr — so `check` in a pipeline yields a
-// parseable verdict while a human still sees the advisories.
-export interface CheckPlan {
-  readonly stdout: string;
-  readonly stderr: string;
-  readonly code: number;
-}
-
-function warningLines(warnings: readonly string[]): string {
-  return warnings.map((w) => `warning: ${w}\n`).join("");
-}
-
-export function checkPlan(o: CheckOutcome): CheckPlan {
-  switch (o.kind) {
-    case "clean": {
-      const where = o.configPath ?? "bundled default (no config file found)";
-      const count =
-        o.warnings.length > 0
-          ? ` (${o.warnings.length} warning${o.warnings.length === 1 ? "" : "s"})`
-          : "";
-      return {
-        stdout: `✓ ${where}: config OK${count}\n`,
-        stderr: warningLines(o.warnings),
-        code: EXIT_CLEAN,
-      };
-    }
-    case "fatal":
-      return {
-        stdout: "",
-        stderr:
-          warningLines(o.warnings) +
-          `✗ ${o.configPath ?? "<default>"}\n${o.message}\n`,
-        code: EXIT_FATAL,
-      };
-    case "unreadable":
-      return {
-        stdout: "",
-        stderr: `check: cannot read ${o.path}: ${o.message}\n`,
-        code: EXIT_USAGE,
-      };
-  }
-}
-
-// `cc-candybar check [path]` — the argv binding. Extra arguments and an empty
-// path argument are usage errors (loud, not silently ignored — the likeliest
-// cause is an unquoted or mis-expanded shell variable). An empty string is not
-// "no argument": `checkConfig(undefined)` means "resolve like the daemon",
-// while `""` is a malformed target that would otherwise EISDIR on the cwd.
-export function runCheck(args: readonly string[]): never {
-  if (args.length > 1 || args[0] === "") {
-    process.stderr.write(
-      "check: expected at most one non-empty path\nUsage: cc-candybar check [config-file]\n",
-    );
-    process.exit(EXIT_USAGE);
-  }
-  const plan = checkPlan(checkConfig(args[0]));
-  process.stdout.write(plan.stdout);
-  process.stderr.write(plan.stderr);
-  process.exit(plan.code);
-}

package/src/cli-flags.ts

@@ -1,8 +0,0 @@
-// [LAW:one-source-of-truth] The bare flags Node answers itself. The dispatch in
-// index.ts reads it, `--help` renders its own lines from it, and the Rust client
-// routes exactly these to Node (its NODE_FLAGS; check-protocol diffs the two),
-// so a spelling added here without its mirror fails the build, not the user.
-export const NODE_FLAGS = {
-  help: ["-h", "--help"],
-  version: ["-V", "--version"],
-} as const;

package/src/click/wire.ts

@@ -1,158 +0,0 @@
-// [LAW:single-enforcer] THE click-wire codec. A click is an ordered list of
-// effects; this module is the one place that serializes that list to a URL and
-// parses it back. The renderer (every click emitter) calls effectsUrl; the
-// daemon's `dispatch` verb calls parseEffects. Encode and decode live together
-// so the format cannot drift between the two halves [LAW:one-source-of-truth].
-//
-// [LAW:dataflow-not-control-flow] N effects ride one URL the SAME way for N=1 and
-// N=100 — a lone click is the degenerate one-element list. There is no
-// plain-vs-compound mode: every URL effectsUrl emits is `dispatch/e=…`, and the
-// effect COUNT is data the dispatcher folds over, never a branch that selects a
-// wire. (The wire still ACCEPTS direct `cc-candybar://<verb>/…` URLs — old
-// scrollback links, a hand-authored `link` template — so a direct verb is the
-// degenerate one-effect case on the parse side; only emission is unified here.)
-//
-// Why query params (not slashes, not base64): the value handed to the daemon is
-// passed RAW (parseHandlerUrl decodes only the verb), so each `e` param survives
-// exactly one URLSearchParams decode and an effect's own slash-bearing value
-// (a path, a set-state key/value tail) round-trips untouched. base64 was
-// rejected as opaque; a slash-nested payload is unsafe under any single
-// whole-value decode (a `%2F` would un-escape into a structural separator). The
-// `e=…&e=…` payload follows the verb after a `/` (`dispatch/e=…`), NOT a `?`, so
-// `/` stays the one verb delimiter and `?` remains ordinary data in a bare-copy
-// value (`cc-candybar://hello?world`).
-
-import { URLSearchParams } from "node:url";
-
-// [LAW:one-source-of-truth] The scheme string lives here, with the codec that
-// emits it; install/ (Launch Services registration) imports it.
-export const URL_SCHEME = "cc-candybar";
-
-// [LAW:one-source-of-truth] The verb vocabulary. The daemon's VERBS registry
-// keys off these and every emitter builds effects with them, so the emitted
-// verb and the dispatched handler cannot name-drift.
-export const VERB_DISPATCH = "dispatch";
-export const VERB_SET_STATE = "set-state";
-// [LAW:types-are-the-program] A RELATIVE state nudge: its args are
-// `[sessionId, key, by]` where `by` is the signed integer delta. Distinct from
-// set-state because the click intent is "step from whatever the value IS now",
-// not "set to this fixed value" — the absolute target is computed at APPLY time
-// from live state, so the link carries no `current` snapshot and N rapid clicks
-// each re-read-and-write. Additive: old set-state links still resolve.
-export const VERB_STEP_STATE = "step-state";
-export const VERB_COPY = "copy";
-export const VERB_OPEN_VSCODE = "open-vscode";
-export const VERB_TOOLBAR_TOGGLE = "toolbar-toggle";
-export const VERB_SHOW_CONFIG_ERROR = "show-config-error";
-export const VERB_SHOW_CONFIG_WARNING = "show-config-warning";
-// [LAW:effects-at-boundaries] A daemon-global config override: the verb writes
-// the override path (or clears it with an empty value); the render pipeline
-// reads it at the cache-lookup boundary. Clicking a different config is a
-// side-effect isolated to the verb handler; the renderer only sees the result.
-export const VERB_LOAD_CONFIG = "load-config";
-// [LAW:one-source-of-truth] `persist`'s twin of set-state/step-state: writes
-// land in the daemon-owned config-overrides layer (never the hand-authored
-// config file), which RenderCache merges on top of the user file every
-// reload — the SAME file-watcher path a hand edit already takes
-// (candybar-config-engine-71o.2). Args: `[sessionId, key, value]` — the
-// sessionId is carried only for click.error surfacing, exactly like
-// set-state; the write itself is daemon-global, not session-scoped.
-// A durable write takes an OPTIONAL trailing segment: the SessionState key to
-// RELEASE once the write has succeeded. A dual-destination control
-// (candybar-settings-ui-aok.3) commits "make this the durable default AND stop
-// overriding it in this session" — one intent, whose session half must not
-// happen if the durable half failed. Carried as one more segment on the write
-// itself rather than as a second effect beside it, because `dispatch` runs
-// every effect in a click by design; a pair would let a rejected write still
-// wipe the user's pick. Args: `[sessionId, key, value, releaseKey?]`.
-export const VERB_SET_CONFIG = "set-config";
-// [LAW:types-are-the-program] A RELATIVE nudge to a bounded config-overrides
-// key (e.g. a padding stepper) — the config twin of step-state. Args:
-// `[sessionId, key, by, releaseKey?]` — the same optional release segment
-// set-config takes, for the same reason.
-export const VERB_STEP_CONFIG = "step-config";
-// [LAW:one-source-of-truth] The gated undo for `persist`: clears one
-// config-overrides key, restoring the user-file/bundled-default value on the
-// next reload. Args: `[sessionId, key]`.
-export const VERB_RESET_CONFIG = "reset-config";
-// [LAW:one-type-per-behavior] brandon-layout-edit-2gc.1's structural-edit
-// verb — a THIRD write semantic beside set-config's plain overwrite and
-// step-config's numeric read-modify-write: read the current op-token LIST at
-// `key` (a "presets.<name>.rootOps" config-overrides target), append the
-// validated `op` token, write the whole list back. Args: `[sessionId, key,
-// op]` — `op` is one opaque token from src/config/layout-ops.ts's codec, the
-// SAME shape a `persist … to` literal's value would be, gated the SAME way
-// (validateConfigWrite) — only the write's SHAPE (append vs. overwrite)
-// differs, which is exactly why this is its own verb rather than another
-// VERB_SET_CONFIG value.
-export const VERB_APPLY_LAYOUT_OP = "apply-layout-op";
-// [LAW:one-source-of-truth] brandon-layout-edit-2gc.2's global history step
-// over the config-overrides layer — the fine-grained sibling of
-// VERB_RESET_CONFIG's coarse "clear one key". Args: `[sessionId]` — there is
-// no key: the history is ONE stack over every persist/reset write ever made
-// to the overrides file (config-overrides-store.ts), not a per-key log. An
-// empty stack is a loud BAD_REQUEST surfaced through click.error like any
-// other verb failure, never a silent no-op.
-export const VERB_UNDO = "undo";
-export const VERB_REDO = "redo";
-
-// [LAW:types-are-the-program] An effect to EMIT: a verb plus its raw (unencoded)
-// positional args. The wire owns all encoding — callers never percent-encode.
-// set-state's args are `[sessionId, key, value, …]`; copy/open carry one arg.
-export interface Effect {
-  readonly verb: string;
-  readonly args: readonly string[];
-}
-
-// [LAW:types-are-the-program] A parsed effect as the dispatcher sees it: the verb
-// and the still-encoded segment tail. The tail stays encoded because the target
-// verb's handler decodes its own segments at its boundary (single-enforcer per
-// verb) — the same contract a direct (non-dispatch) click URL hands a handler.
-export interface ParsedEffect {
-  readonly verb: string;
-  readonly value: string;
-}
-
-// [LAW:single-enforcer] The segment codec. A verb's args serialize to a
-// slash-joined run of percent-encoded segments; the handler decodes the inverse.
-// Encoding each segment means a segment's own `/` becomes `%2F` and never reads
-// as a separator — the slash-safety the old whole-value decode could not give.
-export function encodeSegments(parts: readonly string[]): string {
-  return parts.map(encodeURIComponent).join("/");
-}
-
-export function decodeSegments(value: string): string[] {
-  return value.length === 0 ? [] : value.split("/").map(decodeURIComponent);
-}
-
-// Serialize an effect list to its dispatch URL. Each effect becomes one ordered
-// `e` query param carrying `verb/<encoded-args>`, percent-encoded whole so its
-// internal `/`, `&`, `=` survive as data. The payload follows `dispatch/` (not
-// `dispatch?`) so `/` is the only verb delimiter parseHandlerUrl needs.
-export function effectsUrl(effects: readonly Effect[]): string {
-  const qs = effects
-    .map(
-      (e) => `e=${encodeURIComponent(`${e.verb}/${encodeSegments(e.args)}`)}`,
-    )
-    .join("&");
-  return `${URL_SCHEME}://${VERB_DISPATCH}/${qs}`;
-}
-
-// [LAW:dataflow-not-control-flow] Parse the dispatch verb's raw value (an
-// `e=…&e=…` query string) into the ordered effect list. URLSearchParams decodes
-// each param exactly once and preserves insertion order; splitting each on the
-// FIRST `/` recovers (verb, still-encoded tail) — the same split parseHandlerUrl
-// applies at the top level, one level down.
-export function parseEffects(rawValue: string): ParsedEffect[] {
-  return new URLSearchParams(rawValue).getAll("e").map(splitVerb);
-}
-
-// [LAW:types-are-the-program] Split a `verb/tail` string at the first `/`. A
-// verb with no args (no slash) yields an empty tail — the degenerate case, not a
-// guard. The tail keeps its slashes (further segments) for the handler to decode.
-export function splitVerb(s: string): ParsedEffect {
-  const i = s.indexOf("/");
-  return i === -1
-    ? { verb: s, value: "" }
-    : { verb: s.slice(0, i), value: s.slice(i + 1) };
-}